User authentication for an information handling system using a secured stylus
Security on an information handling system may be improved by using a stylus. A stylus provides unique information about a user that may not be acquired by an information handling system through other methods. For example, a user's handwriting is often unique to that user and may provide a security check on the information handling system to confirm the user's identity. Further, the stylus is usually held in the user's hand and may be used to check the user's fingerprint to confirm the user's identity. These authentication techniques, including fingerprinting and handwriting, may be used to maintain persistent authentication while the user is using the stylus. As the user continues to interact with the information handling system with the stylus, the stylus continues to receive the user's fingerprint and handwriting, which may be checked to confirm the user of the information handling system is still the expected user.
1. A method, comprising:
receiving a request to access content at an information handling system by a user;
receiving a first user handwriting input at the information handling system from the user, wherein the first user handwriting input comprises a user password;
receiving a fingerprint token from a wireless stylus coupled to the information handling system and used to enter the first user handwriting input;
determining whether to approve the request to access content based, at least in part, by:
determining whether the fingerprint token matches the user;
recognizing text in the first user handwriting input, wherein the text comprises the user password; and
determining whether the user password matches the user; and
performing persistent authentication checks upon determining that the request to access content is approved, wherein the performing persistent authentication checks comprises periodic sampling of the user's fingerprint and determining second handwriting biometrics based on a second user handwriting input, wherein the second user handwriting input does not comprise the user password.
2. The method of claim 1 , wherein the step of determining whether to approve the request to access content further comprises:
determining first handwriting biometrics based on the first user handwriting input; and
determining whether the first handwriting biometrics authenticates the user.
3. The method of claim 1 , wherein the step of determining whether to approve the request to access content further comprises:
determining first handwriting biometrics based on the first user handwriting input; and
determining whether the first handwriting biometrics authenticates the user,
wherein the request to access content is approved when each of the user password, the first handwriting biometrics, and the fingerprint token authenticates the user.
4. The method of claim 3 , wherein determining whether the fingerprint token matches the user comprises:
decrypting the fingerprint token with a public key to obtain a hash value; and
determining whether the hash value matches an expected hash value for the user,
wherein the hash value is based, at least in part, on a random secret and an identification value for the user,
and wherein the method further comprises transmitting to the stylus the random secret prior to receiving the first user handwriting input.
5. The method of claim 1 , further comprising:
approving the request to access content based, at least in part, on determining whether the user password of the recognized text authenticates the user; and
after approving the request, determining whether to terminate the access based on at least one of:
receiving a fingerprint token from a wireless stylus coupled to the information handling system during access to the information handling system that does not match the user; or
determining the second handwriting biometrics does not match the user.
6. The method of claim 1 , further comprising enrolling the user prior to receiving the request to access content at an information handling system, wherein enrolling the user comprises at least one of:
receiving a fingerprint token corresponding to the user; or
determining handwriting biometrics for the user based on a handwriting sample from the user.
7. The method of claim 1 , wherein receiving a request to access content at an information handling system comprises receiving a request to exit the information handling system from a standby mode.
8. An information handling system, comprising:
a memory;
a processor coupled to the memory, wherein the processor is configured to perform steps comprising:
receiving a request for a user to access content;
receiving a first user handwriting input from the user, wherein the first user handwriting input comprises a user password;
receiving a fingerprint token from a wireless stylus coupled to the information handling system and used to enter the first user handwriting input;
determining whether to approve the request for the user to access content based, at least in part, by:
determining whether the fingerprint token matches the user;
recognizing text in the first user handwriting input, wherein the text comprises the user password; and
determining whether the user password matches the user; and
performing persistent authentication checks upon determining that the request to access content is approved, wherein performing persistent authentication checks comprises periodic sampling of the user's fingerprint and determining second handwriting biometrics based on a second user handwriting input, wherein the second user handwriting input does not comprise the user password.
9. The information handling system of claim 8 , wherein the step of determining whether to approve the request for the user to access content further comprises:
determining first handwriting biometrics based on the first user handwriting input; and
determining whether the first handwriting biometrics authenticates the user.
10. The information handling system of claim 8 , wherein the step of determining whether to approve the request to access content further comprises:
determining first handwriting biometrics based on the first user handwriting input; and
determining whether the first handwriting biometrics authenticates the user,
wherein the request to access content is approved when each of the user password, the first handwriting biometrics, and the fingerprint token authenticates the user.
11. The information handling system of claim 10 , wherein determining whether the fingerprint token matches the user comprises:
decrypting the fingerprint token with a public key to obtain a hash value; and
determining whether the hash value matches an expected hash value for the user,
wherein the hash value is based, at least in part, on a random secret and an identification value for the user,
and wherein the process is further configured to perform steps comprising transmitting to the stylus the random secret prior to receiving the user handwriting input.
12. The information handling system of claim 8 , wherein the processor is further configured to perform steps comprising:
approving the request to access content based, at least in part, on determining whether the user password of the recognized text authenticates the user; and
after approving the request, determining whether to terminate the access based on at least one of:
receiving a fingerprint token from a wireless stylus coupled to the information handling system during access to the information handling system that does not match the user; or
determining the second handwriting biometrics does not match the user.
13. The method of claim 1 , further comprising:
upon determining that the request to access content is approved, terminating the access based on determining the stylus is not within a proximity of the information handling system;
before a predetermined amount of time after terminating the access based on at least determining the stylus is not within the proximity of the information handling system, determining whether to reauthenticate the user based on whether the stylus is within the proximity of the information handling system; and
after the predetermined amount of time, determining whether to reauthenticate the user based on a third user handwriting input.
14. The information handling system of claim 8 , wherein the processor is further configured to perform steps comprising:
upon determining that the request to access content is approved, terminating the access based on determining the stylus is not within a proximity of the information handling system;
before a predetermined amount of time after terminating the access based on at least determining the stylus is not within the proximity of the information handling system, determining whether to reauthenticate the user based on whether the stylus is within the proximity of the information handling system; and
after the predetermined amount of time, determining whether to reauthenticate the user based on a third user handwriting input.